Detect presence of uncommon user agents in web requests (ASIM Web Session)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

This rule assists in detecting rare user agents, which may indicate web browsing activity by an unconventional process different from the usual ones. The rule specifically searches for UserAgent strings that have not been seen in the past 14 days. This query will perform better when run over summarized data

Attribute	Value
Type	Analytic Rule
Solution	Web Session Essentials
ID	2d50d937-d7f2-4c05-b151-9af7f9ec747e
Severity	Medium
Status	Available
Kind	Scheduled
Tactics	InitialAccess
Techniques	T1190, T1133
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
WebSession_Summarized_SrcInfo_CL 🔶	?	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Analytic Rules · Back to Web Session Essentials